CVE-2024-38530

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

CVE-2024-38530

CVE-2024-38530 affects the Open eClass platform (H5P module) via an arbitrary file upload in the module’s save.php, allowing unauthenticated uploads to the server filesystem. The underlying issue enables potential unrestricted remote code execution on the backend, since the upload location is int...

CVE-2024-38530 Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

The Open eClass platform formerly known as GUnet eClass is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RC...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD that stems from ICMPv6 packets that bypass firewall rules...

USN-6950-1 linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - Block layer subsystem; - Bluetooth drivers; - Clock framework and...

Internet Bug Bounty: CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

CVE-2024-42005: Potential SQL injection in QuerySet.values and valueslist A vulnerability was discovered in Django where the QuerySet.values and valueslist methods on models with a JSONField were subject to SQL injection in column aliases via a crafted JSON object key as a passed argument...

Internet Bug Bounty: [CVE-2024-35176] DoS vulnerability in REXML

CVE-2024-35176: DoS vulnerability in REXML A DoS vulnerability was discovered in the REXML gem. A specially crafted XML document with many '' characters in an attribute value could cause REXML to take a long time to parse it. This issue was assigned the CVE identifier CVE-2024-35176. Users were...

CVE-2024-7267

Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before 19.6...

The vulnerability of the CDwnBindInfo function in the mshtml.dll library of Internet Explorer allows a hacker to execute arbitrary code.

The vulnerability of the CDwnBindInfo function in the mshtml.dll library of the Internet Explorer browser is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code by sending a specially created HTML file...

Enjay CRM 安全漏洞

Enjay CRM is a customer relationship management software from Enjay India. A security vulnerability exists in Enjay CRM versions prior to 19.6 that stems from the presence of a sensitive information vulnerability that allows logged in users to retrieve information about IP infrastructure and...

CVE-2024-23464

In certain cases, Zscaler Internet Access ZIA can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows 4.2.1...

CVE-2024-23464

In certain cases, Zscaler Internet Access ZIA can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows 4.2.1...

CVE-2024-23464

CVE-2024-23464 affects Zscaler Client Connector on Windows prior to 4.2.1. The issue is described as improper preservation of permissions, enabling an attacker with admin rights to run PowerShell commands that can disable Zscaler Internet Access (ZIA) covered by the affected client. The vulnerabi...

CIRCIA – Ley de notificación de incidentes cibernéticos para infraestructuras críticas

¿Qué es CIRCIA? CIRCIA, o Cyber Incident Reporting for Critical Infrastructure Act, es una propuesta de ley que busca fortalecer la seguridad cibernética en los Estados Unidos. Esta legislación tiene como objetivo principal proteger la infraestructura crítica del país, como las redes eléctricas,...

Fedora: Security Advisory (FEDORA-2024-87a7b3f47a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-55603127f3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-27987 · Qualcomm · 315 5G Iot Modem Firmware +210

Name of the Vulnerable Software and Affected Versions: No specific software or affected versions are mentioned in the provided descriptions. Description: A cryptographic issue occurs when a controller receives an LMP start encryption command under unexpected conditions. Recommendations: At the...

Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

Social Security numbers, death certificates, voter applications, and other personal data were accessible on the open internet, highlighting the ongoing challenges in election security...

He Was an FBI Informant—and Inspired a Generation of Violent Extremists

Joshua Caleb Sutter infiltrated far-right extremist organizations as a confidential FBI informant, all while promoting hateful ideologies that influenced some of the internet's most violent groups...

U.S. Dept Of Defense: DoD workstation exposed to internet via TinyPilot KVM with no authentication

The DoD workstation was exposed to the internet via a TinyPilot KVM device without any authentication. The TinyPilot KVM device was connected to the workstation and allowed remote access to the system over the internet...